Privacy Policy
Effective date: 25 September 2026 Last updated: 24 September 2026 Version: 2.0
1. Introduction and Who We Are
Kounisou LLC ("Kounisou," "we," "us," "our") is a Colorado limited liability company operating a fitness coaching SaaS platform at kounisou.com. This Privacy Policy describes how we collect, use, disclose, and protect personal information in connection with the Service.
Contact: Email: admin@kounisou.com Entity: Kounisou LLC, Denver, Colorado
2. Our Role: Controller and Processor
Kounisou operates in two distinct legal roles depending on whose data is being processed:
2.1 Kounisou as Data Controller
Kounisou is the data controller for personal data it collects directly for its own business purposes, including:
- Coach account registration and profile data
- Billing and subscription data
- Platform analytics, error monitoring, and usage data
- Marketing communications (coach-facing)
2.2 Kounisou as Data Processor
Kounisou acts as a data processor — and the Coach is the data controller — for personal data that Coaches upload, enter, or import about their clients. This includes:
- Client names, email addresses, and contact information
- Client health data (biometrics, wearable data, progress photos, measurements)
- Client check-in responses, messages, and notes
- Client nutrition logs and food photos
Coaches are responsible for having a lawful basis to process their clients' data and for informing clients about how their data is handled. Kounisou processes this data solely on behalf of and at the direction of the Coach.
Clients who have questions about how their personal data is used on the platform should contact their Coach directly. Kounisou will assist clients in exercising their rights where technically feasible.
3. Data We Collect
3.1 Data You Provide
| Category | Examples |
|---|---|
| Account data (Coaches) | Name, email address, password |
| Profile data (Coaches) | Business name, bio, certifications, specialties, profile photo, social handles |
| Client records (entered by Coaches) | Client name, email, phone, goals, injury notes, medical notes |
| Health and biometric data | Body weight, body fat %, height, measurements, progress photos, injuries |
| Wearable and health platform data | Heart rate, HRV, SpO2, sleep stages and duration, stress scores, steps, active calories, GPS workout routes (imported from Fitbit, Oura, WHOOP, Strava, Garmin, Apple Health, Health Connect) |
| Nutrition data | Food logs, meal photos (AI-analysed), macro/calorie estimates |
| Communications | Messages between coaches and clients, check-in responses, voice messages (video calls are not recorded) |
| Location (mobile app) | Precise GPS location only while you record a run, to measure its route, distance and pace. It is not collected in the background when no run is being recorded, and it is never used for advertising. |
| Camera and microphone (mobile app) | Photos and videos you choose to capture (progress photos, form-check videos), voice messages and voice food logging, and live video calls — only when you use those features. |
| Booking and scheduling | Appointment requests, booking confirmations |
| Payment data | Processed by Stripe; we do not store card numbers. We receive transaction IDs, subscription status, and billing history. |
3.2 Data Collected Automatically
| Category | Examples |
|---|---|
| Device and browser | IP address, browser type and version, OS, device type, screen resolution |
| Usage data | Pages viewed (with identifiers removed) and named product events — only if you accept analytics |
| Performance and errors | Error logs, crash reports, API response times (via Sentry) |
| Product analytics | Feature usage and funnel events (via PostHog, with your consent) |
| Security | Failed login attempts, CSRF token validations, rate-limit events |
Analytics and error monitoring never receive health data. PostHog runs only if you accept analytics cookies (and never when your browser sends Do Not Track or Global Privacy Control); it does not record sessions or capture clicks automatically, and it records page addresses with identifiers removed. Sentry receives technical error reports without session recordings.
3.3 Data from Third Parties
- Google sign-in: Name and email address when you sign in with Google
- Wearable APIs: Health and activity data you authorise us to pull from Fitbit, Oura, WHOOP, Strava, Garmin, Apple Health, and Google Health Connect
- Stripe: Payment and subscription status, payout information (for Coaches using Stripe Connect)
- Daily.co: Video call metadata (session IDs, durations) when video coaching is used
4. How We Use Your Data
| Purpose | Legal Basis (US applicability) | Data Used |
|---|---|---|
| Account creation and authentication | Contract / legitimate interest | Account data |
| Providing coaching platform features | Contract | All data categories |
| Processing coach subscriptions | Contract | Billing, account data |
| Enabling AI-assisted coaching features | Contract / consent (for health data) | Health data, nutrition data, communications |
| Integrating wearable and health platforms | Consent | Wearable/health data |
| Generating progress reports and insights | Contract | Health, activity, nutrition data |
| Video coaching sessions | Contract | Session metadata |
| Transactional email (receipts, alerts) | Contract | Account, billing data |
| Marketing email to coaches | Consent (can opt out) | Account data |
| Platform analytics and improvement | Legitimate interest | Usage, device data |
| Error monitoring and debugging | Legitimate interest | Error, performance data |
| Security and fraud prevention | Legitimate interest / legal obligation | IP, session, usage data |
| Legal compliance and dispute resolution | Legal obligation | All categories as required |
| Responding to data subject rights requests | Legal obligation | All categories |
We do not use client health data, biometrics, or wearable data for advertising, marketing, or analytics beyond what is necessary to deliver the coaching platform.
5. AI Processing Disclosure
5.1 What We Send to AI Providers
When a Coach uses AI features, we send relevant client data to AI processing services. This may include:
- Fitness goals and current programme data
- Body measurements, biometrics, and progress data
- Nutrition logs and food-photo images
- Check-in responses
- Conversation history (for the client chat assistant)
We route AI requests through OpenRouter to Anthropic Claude models.
5.2 Provider Practices
- Anthropic: Under Anthropic's commercial terms, API inputs and outputs are not used to train its models by default.
- OpenRouter: Routes each request to the model provider.
We do not use your data, or your clients' data, to train AI models.
5.3 No Sale for Training
We do not sell, license, or otherwise make available your data or your clients' data for AI model training purposes.
6. Disclosure and Sharing
6.1 We Do Not Sell Personal Data
We do not sell, rent, or trade personal information — including consumer health data — to third parties for their own marketing or commercial purposes. This applies to all user categories.
6.2 Subprocessors
We share data with the following categories of subprocessors to operate the Service. The full current list is at kounisou.com/subprocessors.
| Subprocessor | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database, auth, file storage | All personal data | US East (AWS) |
| Vercel | Hosting and edge functions | Request data, env vars | US (multiple regions) |
| Stripe | Subscription billing, Connect | Billing, account data | US |
| OpenRouter + Anthropic | AI model routing and inference | Health, fitness, nutrition data (as relevant to request) | US |
| Resend | Transactional email delivery | Email address, name | US |
| Cloudflare Turnstile | Bot detection | IP, browser fingerprint | Global CDN |
| Daily.co | Video coaching sessions | Session metadata | US |
| Sentry | Error and performance monitoring | Error data, IP, session data | US |
| PostHog | Product analytics | Usage, device, session data | US |
| Google Workspace | Company email | As needed for support | US |
| Fitbit (Google) | Wearable data import | OAuth tokens, health data (with consent) | US |
| Oura | Wearable data import | OAuth tokens, health data (with consent) | US / Finland |
| WHOOP | Wearable data import | OAuth tokens, health data (with consent) | US |
| Strava | Activity data import | OAuth tokens, activity, GPS data (with consent) | US |
| Garmin | Activity and health data import | OAuth tokens, health data (with consent) | US |
| Apple Health (Health Kit) | Health data import on iOS | Health data (with consent) | Device-local; synced to Supabase |
| Google Health Connect | Health data import on Android | Health data (with consent) | Device-local; synced to Supabase |
| Firebase Cloud Messaging | Push notifications (planned) | Device tokens | US |
Each subprocessor may use personal data only to provide its service to us, under its data processing terms.
6.3 Within the Platform
- A client's personal data is visible to their assigned Coach (and only that Coach, unless the Studio plan explicitly grants team access)
- Coach profile information is visible to clients and, where the Coach enables it, on a public coach discovery page
- Studio-plan organisations share client access among their designated team members
6.4 Legal Requirements
We may disclose personal data if required by a court order, subpoena, governmental directive, or applicable law, or to protect the rights, safety, or property of Kounisou, its users, or the public. We will attempt to notify you before disclosure where legally permitted.
6.5 Business Transfers
If Kounisou is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users before data is transferred and becomes subject to a different privacy policy.
7. Data Retention
| Data Category | Retention Period |
|---|---|
| Active account data | Retained while account is active |
| Deleted account data | 30-day grace period, then permanent deletion |
| Billing and transaction records | 7 years (tax and legal compliance) |
| Communications (messages) | Deleted with account after 30-day grace period |
| Wearable / health data | Deleted with account after 30-day grace period |
| Error and security logs | 90 days |
| Analytics data (aggregated, anonymised) | Indefinitely (no personal identifiers) |
| Consent records | 7 years (legal compliance) |
| Data export files | Download link valid 24 hours; file deleted within 48 hours |
8. Your Privacy Rights
8.1 US State Privacy Rights
The following rights are available to residents of certain US states:
| Right | CA (CCPA/CPRA) | CO (CPA) | CT (CTDPA) | VA (CDPA) | TX (TDPSA) | How to Exercise |
|---|---|---|---|---|---|---|
| Know / access your data | Yes | Yes | Yes | Yes | Yes | Settings → Export Data |
| Delete your data | Yes | Yes | Yes | Yes | Yes | Settings → Delete Account |
| Correct inaccurate data | Yes | Yes | Yes | Yes | Yes | Edit in settings or email us |
| Opt out of sale | Yes | Yes | Yes | Yes | Yes | We do not sell — N/A |
| Opt out of targeted advertising | Yes | Yes | Yes | Yes | Yes | We do not use targeted advertising — N/A |
| Data portability | Yes | Yes | Yes | Yes | Yes | Settings → Export Data |
| Non-discrimination | Yes | Yes | Yes | Yes | Yes | Always guaranteed |
| Appeal a denied request | N/A | Yes | Yes | Yes | Yes | Email admin@kounisou.com |
To exercise any right: use your account settings (for export and deletion) or email admin@kounisou.com with the subject line "Privacy Rights Request." We will respond within 45 days (extendable by 45 days with notice for complex requests). We will verify your identity before processing requests affecting your account.
8.2 GDPR and UK GDPR
For EU and UK users, we process personal data under the following legal bases:
- Contract: Processing necessary to provide the Service you signed up for
- Consent: Processing of health data, wearable data, marketing emails, and optional features
- Legitimate Interest: Analytics, fraud prevention, security, and service improvement
- Legal Obligation: Tax records, legal compliance, responding to legal requests
EU/UK users have additional rights including the right to lodge a complaint with a supervisory authority, the right to restrict processing, and the right to object to processing based on legitimate interest.
9. Children — 18+ Only
The Service is available only to users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If we learn that we have inadvertently collected data from a user under 18, we will delete that data promptly.
If you are a parent or guardian and believe your minor child has created an account, please contact admin@kounisou.com immediately.
10. Cookies and Tracking
For full details, see our Cookie Policy at kounisou.com/cookies. In summary:
- Essential cookies: Required for authentication and security. Cannot be disabled.
- Analytics cookies: PostHog (product analytics), only if you accept them.
- Preference cookies: Theme settings, consent preferences.
The cookie consent banner lets you accept, customise by category, or choose essential cookies only. Your choice is honoured, and analytics stay off when your browser sends Do Not Track or Global Privacy Control.
11. Security
We implement technical and organisational measures appropriate to the risk, including:
- TLS encryption for all data in transit
- AES-256 encryption for data at rest (Supabase)
- Row-level security (RLS) on all database tables
- Role-based access controls
- Rate limiting, CSRF protection, and input validation
- Real-time error monitoring and security logging
No system is 100% secure. In the event of a breach that triggers notification obligations, we will notify affected users and applicable regulators as required by law (within 60 days under FTC Health Breach Notification Rule if applicable; within 30 days under Colorado law, C.R.S. § 6-1-716; within 72 hours under GDPR).
12. Breach Notification
In the event of a security incident involving personal data:
- We will contain, assess, and remediate the incident
- We will notify affected users as required by applicable state and federal law
- We will notify the FTC if the incident involves personal health records subject to the FTC Health Breach Notification Rule (16 C.F.R. Part 318), within 60 days of discovery
- We will notify Colorado's Attorney General as required by C.R.S. § 6-1-716
- We will notify EU supervisory authorities within 72 hours if GDPR applies
13. International Transfers
Kounisou is headquartered in the United States. Some subprocessors (e.g., Oura, which processes data in Finland) may involve international data transfers. For transfers of EU/UK personal data outside the EEA/UK, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.
Launch market is the United States. EU/UK data processing will require counsel review before Kounisou expands to those markets.
14. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice by email and in-app notification before the changes take effect. The "Last Updated" date at the top reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
15. Contact
For privacy-related questions, data subject requests, or to reach our privacy contact:
Privacy Contact: Email: admin@kounisou.com (subject: "Privacy Request") Entity: Kounisou LLC, Denver, Colorado
We respond to all privacy requests within 45 days.